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Abstract — Elliptic curve cryptography (ECC) is mainly an 
alternative to traditional public-key cryptosystems (PKCs), 
such as RSA, due to its smaller key size with same security 
level for resource-constrained networks. The computational 
efficiency of ECC depends on the scalar point multiplication, 
which consists of modular point addition and point doubling 
operations. The paper emphasizes on point multiplication 
techniques such as Binary, NAF, w-NAF and different 
coordinate systems like Affine and Projective (Standard 
Projective, Jacobian and Mixed) for point addition and doubling 
operations. These operations are compared based on execution 
time. The results given here are for general purpose processor 
with 1:73 GHz frequency. The implementation is done over 
NIST-recommended prime fields 192/224/256/384/521. 

Index Terms — NIST, Binary method, NAF, w-NAF, Projective 
coordinate system, Jacobian coordinate system and Mixed 
coordinate system. 

I. Introduction 

The present and future of both wired and wireless 
communication applications are more conscious about 
security issues. It encourages implementation and usage of 
public key cryptosystems. Specially, Elliptic Curve 
Cryptography (ECC) [1] attracts attention due to its security 
level for smaller key length compared to existing public key 
algorithms such as Rivest-Shamir-Adleman (RSA). The 
underlying strength of ECC is the hard elliptic curve discrete 
logarithm problem (ECDLP), which takes exponential time, 
whereas the RSA takes sub-exponential time. For guaranteed 
security, RSArequire 1024 bits, alternatively ECC takes only 
160 bits [2] [3] . The computational efficiency of ECC depends 
on the chosen appropriate elliptic curve and how fast the 
scalar point multiplication operations are computed over a 
prime field. 

The core part of ECC is the scalar point multiplication. 
For example, any scalar, k, prime field, F p and elliptic curve 
point, P 2 E p , the scalar point multiplication is given by 
k n p . There are different algorithms to represent the scalar 
value and different coordinate systems to perform the point 
addition and point doubling operations. These operations 
are compared computationally due to a trade-off between 
security level and computational performance. All ECC 
operations are computed within the prime field GF (F) as 
well as binary field G F ( F2m ) • The software implementation 
of point multiplication of 163- bit in 13:9 second on 8- bit 
processor with 8 M H z clock is given in [4] . An improvement 
of the work is given [5], which achieved 163- bits multiplication 
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Table I. NIST-Recommended Prime Field, GF (p)[8]. 



Prime "eld F p 


Numerical Value 


Fl92 


2 192 i 2 64 i 1 


F224 


2 224 , 2 96 + 1 


F256 


2 256 i 2 224 + 2 192 + 2 96 i 1 


F384 


2 384 i 2 128 i 2 96 + 2 32 i 1 


F52I 


2 521 ! A 



in 0:75 s. The hardware/software co-design using FPGA 
hardware given in [6]. Moreover the ECC implementation on 
8-bit AVR based RISC processor is discussed in [7] for the 
160- bit. 

Due to easier modular reduction, here we are mainly fo- 
cusing on prime field operations for standard NIST-recom- 
mended prime fields [8] as given in table 1 . Aprime field is not 
the only solution for ECC implementation, but NIST has also 
recommended the binary field G F ( )> which is relatively 
more efficient for hardware implementation. 

II. Ecc Background 

For the prime field p > 3 the basic elliptic curve is given 
by equation 1 [9]. 

E p (a;b) : y 2 = x 3 + ax + b(modp); (1) 

where a and b are constants satisfying 4a 3 + 27b 2 6 0- All 
the operations are computed with in the field, to (p j 1). 
Higher prime fields give more security level but unsuitable 
for memory constrained environments. There is a trade-off 
between security level and memory as well as timing 
requirements. 

For any scalar, k 2 F p and any point, P 2 E p (a; b), the 
scalar point multiplication, k ° P is addition of the point, P 

P + P ,(- ,::: + R 

with itself ( k i 1 ) times I 1 z / . At each stage, the 

ki 1 times 

point multiplication requires point addition and point 
doubling operations. Let for any two points, P (xi ; yi ) and 
Q(X2;y2) 011 tne elliptic curve, there is a point 
R(x 3 ;y 3 ) 2 E p (a;b), such that P + Q = R and point 
doubling 2P = R is computed in the Affine coordinate 
system and the same is given in equation 2 [9] [10]. 
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Point addition 

X 3 = $ 2 j X! j x 2 

Y3 = (xi i x 3 ) j 
* _ y2i yi 

V X 2 j X, 



Point doubling 
x 3 = $ 2 j 2Xi 
ys = (xi i x 3 ) j y! (2 ) 
$ = °" 



3xf + a 
2yi 



Here $ (slope), requires the modular inversion operation, 
which is highly computationally intensive and magnified by 
projective coordinate system is discussed in section IV. 

III. Proposed Techniques For Point Multiplication 

As mentioned, the scalar point multiplication is core part 
for ECC implementation. Here, we discuss different algorithms 
to represent the scalar and to compute the scalar point 
multiplication. 



A. Binary method 

In this method, any scalar, 

binary equivalent by 



k 2 F p , is represented in its 



k = 



nrff 1 



kj n 2' where 



i=0 



f k mi 1 ; km i 2;:::;ki;k g is its binary form and m is the 
length of the scalar [ 1 1 ] . For a point, P 2 E p ( a; b) and scalar 
k, such that Q = k o P . If C A C and C D C are addition and 
doubling operations, respectively, then the total average 
computational cost = ' ^-)A + (m)D 

B. Non-Adjacent Form (NAF) method 

As seen in binary method number of point doubling 
operations is not reducible but the number of point addition 
operations depends on non-zero elements, so, by reducing 
non-zero elements indirectly reducing the number of addition 
operations. If P = (x; y) 2 E p (a; b), then negative of P is 
given by j P = (x; p j y). Thus subtraction of two points 
on an elliptic curve is just as efficient as addition. The NAF 
method uses a signed digit representation for scalar. Let for 
any scalar, k 2 F p is represented in its NAF form by 
nR 1 

k = ki °2';k| 2 f j 1;0;1g [12]. There is unique 

i=0 

canonical representation for each scalar k, which consists of 
digits f j 1 ; 0; 1 g- The point multiplication using NAF method, 
for each digit requires point doubling operation and if kj = j 1 
and kj = 1, then additionally point subtraction and point 
addition operation is performed respectively. 



i 1 : RA 2Ri P 
0:RA 2R 
1 : R A 2R+ P 



As per characteristics of the NAF, representation of sca- 
lar k, with length m, requires at most one digit extra com- 
pared to its binary form with less number of non-zero digits, 
average density of non-zero digit is y. It is denoted by 
NAF(k). Using NAF method for point multiplication, the av- 
erage computation cost incurred is = ' ^MA + (m)D. 



C. Windowed-NAF method 

Between the binary method and the NAF method, the 
NAF is superior to binary, due to the reduced number of non- 
zero digits in its NAF representation, which indirectly results 
in reduced number of addition operations. The w-NAF is an 
extension of NAF method for different window sizes. Any 
scalar, k 2 F p , is represented in its w-NAF and is given by 
np 1 

k = kj 2 ; jkj j ■ 2 Wi 1 , as shown in algorithm 1 [11]. 
i= o 

Algorithm 1 Computing the width-wNAF of a. positive 
Integer 

INPUT: Window width w = k G Fp 
OUTPUT: N A F w (k) 

1) 1 *-o,r «-G 

2) While k> 1 do 

a) If k is odd then 

i) r A k rrxxJ2 w : 

ii) Ifr < 2*" 1 thenkj = f 
uj)ElsekjA rj 2" 

b) Elsekj A 

d) k = k + kj 

e) k A k=£; i A i + 1 

3) End while 

4) Return (kjj 1;^ a ; kj ; k > 

As per the characteristics of w-NAF, there is a unique w- 
NAF representation for scalar k, with length m, the length of 
scalar representation is at most one digit extra compared to 
its binary form, but the total average density of non-zero 
digits is ^rj, which depends on the window-size (w). This 
method requires the number of pre-computations, given by 
(2 Wi 2 j 1) and these pre-computations are: 
f3;5;:::;2 Wi 1 j 1g. For the example, w = 5 the total pre- 
computation is 2 5 ' 2 j 1 = 7 and those are: 
f3P;5P;7P;9P;11P;13P;15Pg 

Algorithm 2 Window NAF method for point 
multiplication 

INPUT: k = {ki-1 , ki-2 , ... 5 kl , kO } and P G Ep (a, b) 
OUTPUT: Q = k * P 

1) Compute Pi = i * Pfori= {1,2. 3. ■ ■ - ,2w-l- 1}. 

2) Q «-cc 5 i«-l- 1 

3) Fori = 

a) Q-2Q 

b) ifki = Othen 

i) if ki > tLea Q ^Q + Pi 

ii) elseQ^ Q-Pi 

4) end for 

5) Return (Q) 
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Table II. Example of scalar representation 



Method 


Representation for k = 1234554321 


D 


A 


Pre- 
computations 


Binary 


1000101110110011101010011001001 


31 


16 





NAF 


1001010-1 010-1 0-100-10100-100-1010001 


31 


13 





NAF 3 (fc) 


100100030010030000-3 00-10000-3 0001 


31 


9 


1 


NAF 4 (fe) 


1000-7 0003000050007000070000-3 0001 


32 


8 


3 


NAF 5 (fc) 


50000-13 0000011000000-13 0000 15 0000-15 


29 


6 


7 



As window size is increased, there is a drastic reduction 
of non-zero digits, which reduces the number of point 
addition to carry out point multiplication operation. The point 
multiplication using w-NAF is carried out as per the algorithm 
2 [12]. The total average computation is given in equation 3. 



Total cost = |1D + (2™^_i 



1)AJ + 



-A + mD 

w + 1 (3) 
prej computations 

As discussed, among various techniques for point 

multiplication, w-NAF is superior compared to others, 

however, it requires pre-computations overhead. Hence, an 

appropriate window size is to be chosen as per memory 

requirements. All these methods are compared with an 

example for a scalar, k and the comparison is given in table U. 

IV. Coordinate Systems 

As discussed in the previous section, point doubling and 
addition given by equations 2 require compute intensive 
inversion operations. To eliminate the modular inversion 
operation, various coordinate systems are considered and 
are evaluated to carry out these operations. 

A. Overview of projective coordinate system 

For a field, p and positive integers, S and t, projective 
coordinates can be defined as an equivalence relation » on 
the set p 3 =(0;0;0) of non-zero triples over p field by 
(X^Y^ZO » (X 2 ;Y 2 ;Z 2 ) , i f 

Xi = . 8 X 2 ;Y 1 = JY^Z! = ^forany^ 2 p D ,wherep D 
represent set of non-zero element of p [13]. The above relation 
can also be represented as 

(X : Y :Z) = (/X^'Y^Z)^ 2 P D 

(X : Y : Z) is called a projective point, and (X; Y;Z) is 
called the representative of (X : Y : Z )• The projective 
form of the Weierstras elliptic curve equation defined over p 
is obtained by replacing x = jj andy = ^r. 

B. Standard projective system and mixed coordinate system 

For s = 1 and t = 1, the projective coordinate system is 
called the standard projective system and the corresponding 
elliptic curve equation is given equation 4. 



Y 2 Z = X 3 + aXZ 2 + b- 



(4) 



For a standard projective coordinate point, Z ^ 0, the 
corresponding affine point is given by ( ^ , y ). The point at 
infinity oo is given by (0 : 1 : 0) and negative point of 
(X : Y : Z) is given by (X : —Y : Z). 
C. Point addition using standard projective 

For P(X 1 : Y\ : Z\) and Q(X 2 : Y 2 : Z 2 ) in the 
standard projective coordinate system, 
R(X 3 : Y 3 : Z 3 ) = P + Q over E p (a, b) is given by [14] 



X 3 = BC 

Y 3 = A(B 2 X 1 Z 2 -A)- B 3 Y X Z 2 
Z$ = B 3 Z\Z 2 



(5) 



where A = Y 2 Z 1 -Y^ Z 2 , B = X 2 Z\ - X^Z 2 , 
C = A 2 Z A Z 2 ~B 3 - 2B 2 Y] Z 2 

Total Addition cost — 12M + 2S, where M and S represent 
multiplication and squaring operations, respectively. 

D. Point doubling using standard projective system: 

Given a point, P = [X\ : Y\ : Z\) in standard 

projective coordinates over E(F p ) : y 2 = x 3 + ax + b, 

2P = (Xs : Y$ : Z 3 ) is given by equation 6 [14] 



X 3 = 2BD 

Y 3 = A(4C — D) — 8B 2 Y? 
Z 3 = 8B 3 



(6) 
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where A = aZ 2 + 3Xl B = Y\Z\,C = X\Y\B, 

D = A 2 -8C 
Total doubling cost . 

E. Jacobian coordinate system 

For and , the projective coordinate system is called the 
Jacobian coordinate system and the corresponding elliptic 
curve equation is given in equation 7. 

Y 2 = X 3 + aXZ 4 + bZ 6 (7) 
The Jacobian point (X, Y, Z), Z ^ corresponds to 
the affine point ( ^ , )• The point at infinity oo is given by 
(1:1:0) and negative point of (X : Y : Z) is given by 
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(8) 



[X : —Y : Z\ In this system, the point doubling formulae 
for Q(Xi, Y x , Z x ) are given by equation 8. [11] 

X 3 = (3Xf + aZf) 2 - 8X X Y 2 
Y 3 = {aXl + aZf){4X x Y 2 - X 3 ) - 8Y* 
Z 3 = 2Y X Z X 

The total computation cost of doubling using the 
Jacobian coordinate system — 4M + 6S- 

V. Proposed Method 
Revisiting equation 8, the computation cost is given by 



But for a 



-3, 



aZ\ => 1M + 2S 



3X* + aZf = S(X 1 + Z*){X 1 - Z^) =► 1M + IS 

The computation cost becomes \M + IS ■ As 
previously discussed, point doubling is performed during 
every iteration of the point multiplication operation and hence, 

for a specific elliptic parameter Ep(— 3,6) reduced total 
computation cost is incurred. For a given point, 
P=(X 1 :Y 1 : Z x ), 2P = {X 3 : Y 3 : Z 3 ) are given by 
equation 9. 



X 3 
Y 3 ~- 



- A 2 - 2D 
(D - X 3 )A 
BZi 



C 2 /2 



(9) 



where A = 3(X X - Z 2 )(X X + Z\ ), B = 2Y X , 

C = B 2 ,D = CX V 

Refer to algorithm 3 for details. 

Now, the total computation cost = 4M + 4S- 

A. Point addition using mixed coordinate system 

This paper discusses another method for point addition, 
which uses both affine and Jacobian coordinate systems. 
This method is called the mixed coordinate system. In this 
method, one point is represented in the Jacobian coordinate 
system, while the other is represented using the affine 
coordinate system. 

The resultant point after addition, is taken in the Jacobian 

coordinate system. Therefore, for a point P{X X , Y x , Z\ ) in 
Jacobian coordinates and Q(x, y) = Q(X2, Y2, Z2, 1) in 
affine coordinates, where x 2 = X%, t/2 = Y2 anc ' Z 2 = 1' 
J R = P + Qisgiven.[ll] 



ENPLT: P = (Xi : Y\ : Z{] in Jacobian coordinates 

over Ep{-% h):y 2 = -3x + b 

OUTPUT: 2P = (X 3 : F3 : Z 3 ) in Jacobian 

coordinates. 

1 . if P = 00 then Retum(P) 

2. .4 +- 3(.Xi - Zl )(X t + Z\) 

3. 8i-Wi 

4. Z 3 t- M\ 

5. '(?*-,& 

6. D^CXi 

7. Xs^A*-2D 

8. Y$^(D-Xs)A-C 2 f2 

9. Return (X$ : 7 3 : Z 3 ) 

Algorithm 4 Point addition (y 2 = £ 3 + ax + £> = 
affme-Jacobian (mixed) coordinates) 

INPUT: P = [Xi :Y\\ Z\) in Jacobian coordinate, 

Q = ?A>) m affine coordinates on 

E{F p ) : y 2 = ^ + ax + h. 

OUTPUT: P + Q=[Xs : 7 3 : Z 3 ) in Jacobian 

coordinates. 

1) if Q - cc then Return^ : Yj : Z\). 

2) if P = 00 theu Return^ : ?/2 : l). 

3) 4 tr- Zl 

4) B4-Z1A 

5) Ct-X 2 A 

6) D i- Y 2 B 

7) E*-.C.-Xi 

8) F^D-Yi 

a) if £ — then 

i) if F ——■ then use algorithm 3 to 
compute 

{X i :Y z :Z^) = 2{x 2 , m , 1) and 
Rfitnni(X 3 : Yi : Z 3 ) 

9) G^E 2 

10) H <- GE 

U)X$^ F 2 -(U + 2I) 

13) r 3 ^F(J- Xs)-YiH 

14) Z 3 ¥- Z\E 

15) Retura(X 3 : 7 3 : Z 3 ) 

X 3 = (Y 2 Zf - Y x ) 2 - (X 2 Z X - Xi) 2 (Xi + X 2 Z 2 ) 
Y 3 = (Y 2 Zf - Y l ){X l {X 2 Zl) - X 3 ) 



-Y x {X 2 Zl - X x f 



Algorithm 3 Point doubling (y 2 
Jacobian coordinate for a = 3) 



ax + b, using 



Z 3 — (X 2 Z 2 — X X )Z X 
The point addition is presented in algorithm 4 



(10) 
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The total computation cost for point addition — 8M + 3S 

VI. Results And Comparisons For Nist-Recommended Prime 
Fields 

We have implemented ECC point multiplication in C/C++ 
using GCC compiler running under a Linux platform, with 
Intel Pentium processor operating at a clock frequency of 
1 . 73 GH Z - The modular multiplication and modular inversion 
operations are compared for the NIST recommended prime 
fields because the modular operation is less compute 
intensive for the specific prime field. 

A comparison of different point multiplication techniques, 
Binary, NAF, w NAF for NIST prime fields is given in figure 
1. As can be noticed that the number of addition operations 
is drastically reduced from Binary to NAF and NAF to w 
NAF. But higher window sizes require pre computations and 
more over the number of point doubling operations are 
irreducible, which is directly proportional to the length of the 
prime field. 

Timing results for the modular multiplication and modular 
inversion for different prime fields are given in table III, as 
per the required clock cycles to compute specific operations. 

Different coordinate systems are used to eliminate the 



300 



modular inversion operation, which is a computationally 
intensive operation. A comparison of various coordinate 
systems, Affine, Standard Projective, Jacobian and Mixed 
coordinate system based on the required number of inversion, 
multiplication and squaring operations along with their 
execution timings in milli-seconds for scalar point 
multiplication is given in table IV. 

Table III. Timing Of Multiplication And Inversion Operations In 
Microsecond For NIST Prime Fields 



Operation 


Fl92 


^224 


F 2 56 


F^84 


F521 


Multiplication 


5.727 


9.683 


11.678 


24.077 


35.941 


Inversion 


88.298 


365.573 


>55.169 


1411.323 


3012.589 



We also propose an algorithm for point doubling for a 
specific elliptic curve, E p (— 3, b), which requires less number 
of multiplication and squaring operations relatively. A point 
doubling operation, using Jacobian coordinate, requires 0.057 

millisecond for E p (a, b), but the same requires 0.0458 
millisecond for . 

Finally, an overall comparison of all of the point 
multiplication methods for the NIST-recommended prime filed 
as well as different coordinate systems to perform point 
addition and point doubling operations is given in table- V. 




100 200 300 400 

Figure 1. Comparison of various point multiplication techniques 



eoo 



VI. Conclusions 

ECC is widely accepted due to its high security per bit 
compared to traditional RSA public key cryptography. The 
efficiency of ECC depends on the scalar point multiplication 
operation. This paper has discussed various point 
multiplication methods. The computational time for inversion 
operation is increasing exponentially for higher prime fields 
compared to multiplication operation. The point multiplication 
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can be efficiently computed using windowed-NAF and by 
choosing an appropriate window size to meet memory 
constraints. Different coordinate systems are used to eliminate 
the expensive inversion operation. The point doubling is 
efficiently computed using Jacobian coordinate system for 

E p (— 3, b) and the point addition is efficiently computed 
using mixed (affine + Jacobian) coordinate system as per the 
results shown in table IV. 
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Table IV. Timing of the different coordinate system in millisecond for scalar point multiplica 







Doubling(D) 


Addition(A) 


Timing 


Coordinate 
system 




I 


M 


S 


I 


M 


S 


Fl92 


F224 


F 2 56 


F384 


F521 




D 


A 


D 


A 


D 


A 


D 


A 


D 


A 


Affine 


1 


2 


2 


1 


2 


1 


0.111 


0.105 


0.404 


0.394 


0.701 


0.69 


1.507 


1.483 


3.156 


3.12 


Projective OGp 







7 


5 





12 


2 


0.068 


0.08 


0.116 


0.135 


0.14 


0.163 


0.288 


0.337 


0.431 


0.503 


a = — 


3 





7 


3 





12 


2 


0.057 


0.08 


0.096 


0.135 


0.116 


0.163 


0.24 


0.337 


0.359 


0.503 


Jacobian CI 6 f> 







4 


6 





12 


4 


0.057 


0.091 


0.096 


0.154 


0.116 


0.186 


0.24 


0.358 


0.359 


0.575 


a = — 


3 





4 


4 





12 


4 


0.0458 


0.091 


0.077 


0.154 


0.093 


0.186 


0.192 


0.358 


0.287 


0.575 


Mixed 











8 


3 




0.062 




0.106 




0.128 




0.264 




0.395 
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Table V. Timing For Scalar Point Multiplication For NIST Prime 
Field In Milliseconds 



NIST 
prime 
field 


Point 

multipl- 
ication 
method 


Coordinate system 


Affine 


projective 


Jacobian 


Mixed 


Fl92 


Binary 


11.39 


18.62 


17.52 


14.74 


NAF 


!8.03 


16.06 


14.61 


12.76 


3-NAF 


!5.82 


14.38 


12.70 


11.45 


4-NAF 


!5.30 


13.98 


12.25 


11.14 


5-NAF 


!4.67 


13.50 


11.70 


10.77 


F224 


Binary 


34.6 


36.62 


34.49 


29.12 


NAF 


19.6 


31.49 


28.64 


25.09 


3-NAF 


12.5 


29.06 


25.87 


23.18 


4-NAF 


08.2 


27.57 


24.17 


22.01 


5-NAF 


05.0 


26.49 


22.94 


21.17 


F256 


Binary 


!67.7 


50.56 


47.61 


40.19 


NAF 


138.1 


43.55 


39.61 


34.68 


3-NAF 


223.6 


40.12 


35.71 


32 


4-NAF 


!14.6 


38.00 


33.29 


50.33 


5-NAF 


08.4 


36.54 


31.62 


29.18 


F.S84 


Binary 


!63.4 


156.8 


142.4 


124.4 


NAF 


68.5 


135.2 


118.5 


107.5 


3-NAF 


21.0 


124.5 


108.0 


)9.07 


4-NAF 


189.9 


117.4 


100.5 


)3.52 


5-NAF 


173.6 


113.7 


96.64 


)0.62 


F521 


Binary 


2460 


317.8 


304.2 


257.4 


NAF 


1188 


274.0 


254.2 


223.0 


3-NAF 


2054 


252.4 


229.4 


206.0 


4-NAF 


1973 


239.3 


214.5 


195.8 


5-NAF 


1920 


230.8 


204.7 


189.1 
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